How to detect finalization of subsearches?

[huszti21]

Hi all,

regarding a complete monitoring for our customers we want to detect if a subsearch is finalized.
If this happens the search results of the corresponding main search could be incomplete.
Especially for scheduled searches, where no user gets a feedback, this would be helpful.

Is there any log channel, where this is logged?
I tried starting splunk in debug-mode but found nothing.

The only place are the search-logs, but indexing every search-log seems a bit oversized.

Any one out there who could provide a hint?

Thanks!

[gjanders · Accepted solution]

SearchHeadLevel - Users with auto-finalized searches

Is the savedsearch name I use in Alerts for Splunk Admins, refer to https://raw.githubusercontent.com/gjanders/SplunkAdmins/master/default/savedsearches.conf or the full app https://splunkbase.splunk.com/app/3796/

You will need to enable splunk search messages, limits.conf setting log_search_messages=true

[PickleRick]

Correct me if I'm wrong but I don't think there's reliable way to detect such things. That's why using subsearches in situations when they can "runaway" to such big result sets is highly discouraged and such searches should be reconsidered and possibly redesigned to use other means of getting same results.